jboss/base missing 'ss' command

[aslakknutsen]

After the change from fedora:20 to centos:7, the base jboss/* image is missing the 'ss' command.
328f451

Strangely enough, it's part of centos:7.

Arquillian Cube is using 'ss' by default to detect when a Service inside a Container is actually started.
arquillian/arquillian-cube#274 (comment)

[goldmann]

Are you sure? :)

$ docker run -it --rm centos:7 ss  
exec: "ss": executable file not found in $PATH
Error response from daemon: Cannot start container e15dc5a495d4756ad34b6d71cf1e4a1fef08f1a4fb5e023071575a865221b735: [8] System error: exec: "ss": executable file not found in $PATH

[goldmann]

In centos this tool is provided with the iproute package. I was not able to run it properly without --privileged switch, but you're aware of it, right?

[aslakknutsen]

hmmm...

docker@dev:~$ docker images
REPOSITORY                 TAG                 IMAGE ID            CREATED             SIZE
centos                     7                   1739fd39d603        3 months ago        172.3 MB
...


docker@dev:~$ docker run -it centos:7 ss
Netid  State      Recv-Q Send-Q   Local Address:Port       Peer Address:Port   

[goldmann]

That's an old image!

➜  ~  docker images | grep centos
docker.io/centos                                                                                   7                                           c8a648134623        5 weeks ago         196.6 MB

[aslakknutsen]

I'm glad naming/tagging and full systems packaged in containers make for a reproducable test.. :/

[aslakknutsen]

In centos this tool is provided with the iproute package. I was not able to run it properly without --privileged switch, but you're aware of it, right?

Hmm, no. All I know it's been working for our need as long as it's there. We're not running containers as privileged.

[goldmann]

Hmm, without --privileged you get something like this:

docker run -it --rm centos:7 bash             
[root@98053026a8c0 /]# Usage of loopback devices is strongly discouraged for production use. Either use `--storage-opt dm.thinpooldev` or use `--storage-opt dm.no_warn_on_loop_devices=true` to suppress this warning.
[root@98053026a8c0 /]# yum install -y iproute
Loaded plugins: fastestmirror, ovl
base                                                                                                                                                                                                                                                               | 3.6 kB  00:00:00     
extras                                                                                                                                                                                                                                                             | 3.4 kB  00:00:00     
updates                                                                                                                                                                                                                                                            | 3.4 kB  00:00:00     
(1/4): base/7/x86_64/group_gz                                                                                                                                                                                                                                      | 155 kB  00:00:00     
(2/4): extras/7/x86_64/primary_db                                                                                                                                                                                                                                  |  90 kB  00:00:00     
(3/4): updates/7/x86_64/primary_db                                                                                                                                                                                                                                 | 2.3 MB  00:00:00     
(4/4): base/7/x86_64/primary_db                                                                                                                                                                                                                                    | 5.3 MB  00:00:01     
Determining fastest mirrors
 * base: centos.komster.pl
 * extras: ftp.icm.edu.pl
 * updates: ftp.icm.edu.pl
Resolving Dependencies
--> Running transaction check
---> Package iproute.x86_64 0:3.10.0-54.el7 will be installed
--> Processing Dependency: libxtables.so.10()(64bit) for package: iproute-3.10.0-54.el7.x86_64
--> Running transaction check
---> Package iptables.x86_64 0:1.4.21-16.el7 will be installed
--> Processing Dependency: libnfnetlink.so.0()(64bit) for package: iptables-1.4.21-16.el7.x86_64
--> Processing Dependency: libnetfilter_conntrack.so.3()(64bit) for package: iptables-1.4.21-16.el7.x86_64
--> Running transaction check
---> Package libnetfilter_conntrack.x86_64 0:1.0.4-2.el7 will be installed
--> Processing Dependency: libmnl.so.0(LIBMNL_1.1)(64bit) for package: libnetfilter_conntrack-1.0.4-2.el7.x86_64
--> Processing Dependency: libmnl.so.0(LIBMNL_1.0)(64bit) for package: libnetfilter_conntrack-1.0.4-2.el7.x86_64
--> Processing Dependency: libmnl.so.0()(64bit) for package: libnetfilter_conntrack-1.0.4-2.el7.x86_64
---> Package libnfnetlink.x86_64 0:1.0.1-4.el7 will be installed
--> Running transaction check
---> Package libmnl.x86_64 0:1.0.3-7.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

==========================================================================================================================================================================================================================================================================================
 Package                                                                        Arch                                                           Version                                                                 Repository                                                    Size
==========================================================================================================================================================================================================================================================================================
Installing:
 iproute                                                                        x86_64                                                         3.10.0-54.el7                                                           base                                                         526 k
Installing for dependencies:
 iptables                                                                       x86_64                                                         1.4.21-16.el7                                                           base                                                         424 k
 libmnl                                                                         x86_64                                                         1.0.3-7.el7                                                             base                                                          23 k
 libnetfilter_conntrack                                                         x86_64                                                         1.0.4-2.el7                                                             base                                                          53 k
 libnfnetlink                                                                   x86_64                                                         1.0.1-4.el7                                                             base                                                          26 k

Transaction Summary
==========================================================================================================================================================================================================================================================================================
Install  1 Package (+4 Dependent packages)

Total download size: 1.0 M
Installed size: 3.0 M
Downloading packages:
warning: /var/cache/yum/x86_64/7/base/packages/libmnl-1.0.3-7.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Public key for libmnl-1.0.3-7.el7.x86_64.rpm is not installed
(1/5): libmnl-1.0.3-7.el7.x86_64.rpm                                                                                                                                                                                                                               |  23 kB  00:00:00     
(2/5): iproute-3.10.0-54.el7.x86_64.rpm                                                                                                                                                                                                                            | 526 kB  00:00:00     
(3/5): libnetfilter_conntrack-1.0.4-2.el7.x86_64.rpm                                                                                                                                                                                                               |  53 kB  00:00:00     
(4/5): iptables-1.4.21-16.el7.x86_64.rpm                                                                                                                                                                                                                           | 424 kB  00:00:00     
(5/5): libnfnetlink-1.0.1-4.el7.x86_64.rpm                                                                                                                                                                                                                         |  26 kB  00:00:00     
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                                                                                                     2.4 MB/s | 1.0 MB  00:00:00     
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Importing GPG key 0xF4A80EB5:
 Userid     : "CentOS-7 Key (CentOS 7 Official Signing Key) <security@centos.org>"
 Fingerprint: 6341 ab27 53d7 8a78 a7c2 7bb1 24c6 a8a7 f4a8 0eb5
 Package    : centos-release-7-2.1511.el7.centos.2.10.x86_64 (@CentOS)
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : libnfnetlink-1.0.1-4.el7.x86_64                                                                                                                                                                                                                                        1/5 
  Installing : libmnl-1.0.3-7.el7.x86_64                                                                                                                                                                                                                                              2/5 
  Installing : libnetfilter_conntrack-1.0.4-2.el7.x86_64                                                                                                                                                                                                                              3/5 
  Installing : iptables-1.4.21-16.el7.x86_64                                                                                                                                                                                                                                          4/5 
  Installing : iproute-3.10.0-54.el7.x86_64                                                                                                                                                                                                                                           5/5 
  Verifying  : iptables-1.4.21-16.el7.x86_64                                                                                                                                                                                                                                          1/5 
  Verifying  : libnetfilter_conntrack-1.0.4-2.el7.x86_64                                                                                                                                                                                                                              2/5 
  Verifying  : libnfnetlink-1.0.1-4.el7.x86_64                                                                                                                                                                                                                                        3/5 
  Verifying  : iproute-3.10.0-54.el7.x86_64                                                                                                                                                                                                                                           4/5 
  Verifying  : libmnl-1.0.3-7.el7.x86_64                                                                                                                                                                                                                                              5/5 

Installed:
  iproute.x86_64 0:3.10.0-54.el7                                                                                                                                                                                                                                                          

Dependency Installed:
  iptables.x86_64 0:1.4.21-16.el7                                    libmnl.x86_64 0:1.0.3-7.el7                                    libnetfilter_conntrack.x86_64 0:1.0.4-2.el7                                    libnfnetlink.x86_64 0:1.0.1-4.el7                                   

Complete!
[root@98053026a8c0 /]# ss
Netid  State      Recv-Q Send-Q                                                                                           Local Address:Port                                                                                                            Peer Address:Port                
Cannot open netlink socket: Permission denied
Cannot open netlink socket: Permission denied
Cannot open netlink socket: Permission denied
Cannot open netlink socket: Permission denied

[aslakknutsen]

Seems related; CentOS/sig-cloud-instance-images#40